Privacy Policy

homely.je is operated by Granite Digital, a business registered in Jersey under company number 36294. Granite Digital is the data controller for the personal data described in this policy, which means we decide what is collected and why.

For anything in this policy — a request about your data, a correction, or a question — write to info@homely.je. There is one address and a person reads it.

We have not appointed a Data Protection Officer. We are not required to, and rather than leave that as a gap in the list above, the contact address is the route for every request.

Jersey’s conditions for processing are in Schedule 2 of the DPJL. Each activity below names its own condition rather than the page naming one for everything, because a single basis quoted over a whole site is not doing the job the Law asks of it.

This section is for you rather than for a visitor, and it is the part of this policy that most websites do not need. Homely is an index: we read Jersey estate agents’ own public websites and republish what they advertise. Where an agency prints the name, telephone number or email address of the negotiator handling a property, that detail is part of the listing and is reproduced with it.

Everything this site says about a property — its price, its photographs, its description, its floor area, its tenure — comes from the estate agent advertising it, and is reproduced as they published it. We do not write property descriptions, we do not verify the facts in them, and we do not correct them.

The consequences of that, including what a reader should do before relying on any figure here, are set out in full in clause 4 of the Terms and Conditions. In short: check with the agent before acting on anything you read on this site.

Jersey has no equivalent of the UK’s PECR or the EU ePrivacy Directive, so there is no Jersey rule requiring consent before storing something in your browser; the obligation comes from the general data protection law instead. We mention that because it makes the next sentence a choice rather than a legal necessity, and worth saying out loud:

What we do count is described in clause 5.1, and the reason it does not change that answer is that it involves nothing about you.

What is stored, in full:

A signed-out visitor is stored nothing at all beyond the column preference and the already-counted note, if they set one. Signing out clears the cookie and revokes the session; clearing your browser’s site data removes the rest. If we ever add a third-party analytics product, or start counting anything that identifies a person, this section changes and a consent banner arrives with it — we would ask, even though in Jersey we would not have to.

We do not sell, rent or trade personal data, and we share none of it with advertisers or data brokers. There is no advertising on this site.

Article 66 of the DPJL allows a transfer to a country outside Jersey where that country ensures an adequate level of protection. Jersey does not maintain its own adequacy list: it relies directly on the adequacy decisions of the European Commission.

This site’s database, files and sign-in service are configured to hold data in the European Union, in Google’s Netherlands region. Account and support data may also be processed in the United States by Google LLC, which is certified under the EU–US Data Privacy Framework. That framework is a European Commission adequacy decision, so the transfer is adequate under Article 66(2)(a). We additionally rely on the Standard Contractual Clauses in Google’s data processing terms, which are recognised as an appropriate safeguard under Article 67(2)(c) — belt and braces, because adequacy decisions have been annulled before.

You can ask us for details of the safeguards applying to any particular transfer at info@homely.je.

The Law allows a policy to state either a retention period or the criteria used to decide one. We state criteria, because a fixed number here would be a promise about a deletion process, and a promise nobody keeps is worse for you than an honest rule.

• Your account, and everything in it — for as long as the account exists. Delete it and the account, your saved properties and your saved searches go with it.
• Emails you send us — while there is a realistic prospect of the conversation continuing, then deleted. We review the mailbox annually, which is an interval we will actually keep rather than a monthly one we would not.
• Server logs — the hosting platform’s own rotation. We do not extract, archive or analyse them.
• Negotiator details in a listing — while the agency advertises the property, plus the fourteen-day window in clause 4.1, and removed sooner on request.
• Backups — deleted data may persist in backups for a short period before those rotate. It is not accessible for any ordinary use while it does.

Whatever the criteria say, you can ask us to erase your data at any time and we will, unless the law requires us to keep something. That is section 9, and offering it here is what makes a criteria-based rule reasonable rather than evasive.

Part 6 of the DPJL gives you the following rights over personal data we hold about you. They apply whether or not you have an account.

• Access (Articles 28–30) — confirmation of what we hold and a copy of it.
• Rectification (Article 31) — correction of anything inaccurate or incomplete. Note that this reaches data we hold about you; a wrong figure in an agent’s listing is corrected by the agent, and clause 4 of the Terms explains how to reach them.
• Erasure (Article 32) — deletion of your data, subject to anything the law requires us to keep.
• Restriction (Article 33) — an instruction to hold data but stop using it, in the circumstances the Article sets out.
• Portability (Article 34) — a copy in a structured, commonly used, machine-readable format.
• Objection (Article 35) — to processing we carry out on the legitimate-interests condition. Both of ours are named in clause 2.1.
• Objection to direct marketing (Article 36) — absolute and unconditional. We send none today, so there is nothing to object to, and if that ever changes it will be by opt-in.
• Automated decisions (Article 38) — we take none. Filtering and sorting listings is a query you ran, not a decision made about you, and nothing on this site profiles anyone or produces a legal or similarly significant effect.

We rely on consent for nothing described in this policy, so there is no consent here to withdraw. Were we to start relying on it — for a marketing email, say — withdrawing it would be made exactly as easy as giving it, which the Law requires.

To exercise any of these, write to info@homely.je. There is no form and no fee. We may ask you to confirm who you are, but only where we genuinely cannot tell — handing your data to somebody who asked for it convincingly is its own breach.

If you are unhappy with how we have handled your personal data, please tell us first at info@homely.je — we would rather fix it. You do not have to, and nothing below depends on your having done so.

You have the right to complain to Jersey’s data protection regulator, the Jersey Office of the Information Commissioner. It is the JOIC and not the UK’s Information Commissioner’s Office that supervises this site.

Data is held on Google Cloud infrastructure, encrypted in transit and at rest. Access to personal data is restricted to the people who need it to run the site. The database refuses to serve account data to a browser at all — every read of the catalogue happens on our servers, and the only records a signed-in browser can reach are that person’s own. Passwords are hashed by Google and are not visible to us even in principle.

No transmission over the internet is completely secure and we do not claim otherwise. If a breach occurs that is likely to result in a risk to people’s rights and freedoms, we will report it to the JOIC without undue delay and, where feasible, within 72 hours of becoming aware of it, as Article 20 requires. Where the risk to you is high, we will tell you directly, in plain language, without undue delay. We keep a record of every breach, including the ones we are not required to report.

This site is not aimed at children and we do not knowingly hold personal data about them. Jersey sets the age at which a child can consent to an online service at 13 (Article 11(4) DPJL), which is lower than the UK’s. If you believe we hold data about a child, tell us at info@homely.je and we will delete it.

Every listing links to the estate agent’s own website, and their privacy practices are theirs rather than ours. This policy covers homely.je only. Following a link means arriving at a site with its own policy, which is worth reading before giving it anything.

We may update this policy as the site changes. The date at the top moves when the text does, and it is set by hand rather than by a deployment, so it means what it says: the day the wording last changed. If a change materially affects how we handle your data, and you have an account, we will tell you by email before it takes effect rather than afterwards.

Questions about this policy, or anything in it: info@homely.je. Our full details are in section 1, and the regulator’s are in section 10.